I hacked macOS!!!

CVE-2022-32947

With Lina✨ & Cyan💎

GitHub · Video

On today's menu...

• A bit about GPUs
• How virtual memory works
• What's a GPU command buffer?
• Apple's super secret uPPL
• Return-oriented programming
• Special demo!

But first a demo!!!

Live demo · Source code

GPU intro

CPU vs. GPU

How Apple GPUs work

That day in 2022...

Virtual Memory

What's a page table anyway?

Pointers

#include <iostream>

	using namespace std;

	int main() {
		int a = 0;
		void *p = &a;

		cout << "&a is " << p << " nya!" << endl;
	}

&a is 0x7fffc6ba5ddc nya!

This is a virtual address!
↓

0x7fffc6ba5ddc

↓
0x814745ddc
↑
This is the physical address!

How does this work?

GPU/CPU Memory

Page Tables

Permissions

TTBAT

Translation Table Base Address Table

That day in 2022...

Hacking command buffers

Weird machines?

Command buffers

Micro Commands

It's Turing Complete!

• 2 64-bit scratch registers
• Loads and stores (direct only)
• AND, OR, XOR, shifts
• Test for zero ("if")
• Jump / Conditional jump

Tricks

Indirect read/writes?
R0 = *R1;

Tricks

Multiply?
R1 = 10 × R0;

We can:

• Read/write firmware data memory
• Do math

We can't:

• Modify the firmware code
• Modify the page tables

But...

uPPL

More secrets...

uPPL can map memory!

• If page is uPPL: DENY
• If page is page table: DENY
• If page is secure uPPL/kernel data: DENY
• If page is TTBAT.... ??? ALLOWED!!!

They forgot to blocklist that one!!!!

Hack Idea

• Make fake PT that gives access to the real PTs
• Ask uPPL to give us access to the TTBAT
• Write fake PT to TTBAT (context 63 TTB0)
• Ask uPPL to activate context 63
• Write fake PT address to TTB1 page table

GPU can now read/write page tables directly!!

Problem

We can read/write stuff from the microsequence, but we can't call the uPPL...

We can't modify the firmware code directly...

Solution

Return-oriented Programming (ROP)!

Return-oriented programming

More weird machines????

Call and return

Multiple calls?

Challenge!

Data registers

Gadgets can be weird...

g_calltwo: Call two functions...

But the first argument is a pointer to a pointer to a pointer to the function

And the second one is a pointer to 0x70 before a pointer to the function

Gadgets can be weird...

g_store: Store a value to memory...

But it actually stores to the address you pass plus 0xa78

Exploit time!

This is going to be so yabai...

Putting it together

• Shader: Set up microseq and ROP chain data in unused memory
• Shader: Overwrite microseq pointers
• Microsequence: Calculate and fill in a lot of data using firmware info, then overwrite stack to start ROP
• ROP: Use uPPL bug and make a page table accessible to shaders
• Shader: Map more page tables and get access to ALL RAM
• Profit?????

It's hard to demo this all working in practice...

Challenge Accepted!